tcf_ct_handle_fragments() returns TC_ACT_CONSUMED when tcf_ct_ipv4/6_is_fragment() fails. This causes the caller to believe the skb was consumed, but it was not freed. Each malformed fragment leaks one skb, leading to OOM DoS under sustained traffic. Change the return value to TC_ACT_SHOT so the skb is properly freed by the caller. Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") Signed-off-by: Dudu Lu --- net/sched/act_ct.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 7d5e50c921a0..870655f682bd 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -1107,8 +1107,10 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, return retval; out_frag: - if (err != -EINPROGRESS) + if (err != -EINPROGRESS) { tcf_action_inc_drop_qstats(&c->common); + return TC_ACT_SHOT; + } return TC_ACT_CONSUMED; drop: -- 2.39.3 (Apple Git-145)